docker-bench-security

Docker Bench for Security The Docker Bench for Security is a script that checks for dozens of common best-practices around deploying Docker containers in production. The tests are all automated, and are based on the CIS Docker Benchmark v1.6.0. We are making this available as an open-source utili...

NSEC3-X

DISCLAIMER: This project was generated by Artificial Intelligence AI but has undergone a rigorous "Human-in-the-Loop" HITL process. This means the code has been reviewed and refactored by a human software engineer, the architectural design was human-directed, and a basic security audit was...

dalfox

Dalfox is a powerful open-source tool that focuses on automation, making it ideal for quickly scanning for XSS flaws and analyzing parameters. Its advanced testing engine and niche features are designed to streamline the process of detecting and verifying vulnerabilities. Key features Subcommands...

tsharkVM

💡 Update: tshark-opensearch More recent application tshark-opensearch is now available. You can find it in the https://github.com/h21-lab/apps-collection-info repository. 👉 Get Access tshark ELK VM appliance This project builds virtual machine which can be used for analytics of tshark -T ek ndjso...

CVE-2026-120953 Atlas SQL JDBC Driver <=4.0.0: OIDC discovery endpoints not scheme-validated - attacker-controlled URI dispatched to OS protocol handler

A URI redirection weakness exists in the authentication component of the Atlas SQL JDBC Driver. During an interactive sign-in flow the driver accepts endpoint addresses supplied by the remote endpoint it is pointed at without validating their scheme, and passes the resulting address to the local...

CVE-2026-120953 Atlas SQL JDBC Driver <=4.0.0: OIDC discovery endpoints not scheme-validated - attacker-controlled URI dispatched to OS protocol handler

A URI redirection weakness exists in the authentication component of the Atlas SQL JDBC Driver. During an interactive sign-in flow the driver accepts endpoint addresses supplied by the remote endpoint it is pointed at without validating their scheme, and passes the resulting address to the local...

CVE-2026-39379 GeoNetwork: Reflected XSS through client-side template injection

GeoNetwork is a catalog application to manage spatially referenced resources. From 3.0.0 until 4.2.15 and 4.4.10, requesting a nonexistent or unauthorized service URL can cause an error page to reflect attacker-controlled request content inside an AngularJS application without adequately...

CVE-2026-39379 GeoNetwork: Reflected XSS through client-side template injection

GeoNetwork is a catalog application to manage spatially referenced resources. From 3.0.0 until 4.2.15 and 4.4.10, requesting a nonexistent or unauthorized service URL can cause an error page to reflect attacker-controlled request content inside an AngularJS application without adequately...

CVE-2026-120954 Silent element-count truncation via 32-bit bit-length overflow in packed-bit vector views

A weakness in the BSON library's handling of a specialized binary vector data type allows an arithmetic wraparound when computing the number of elements described by an oversized attacker-supplied value. On builds where the platform word size is 32 bits, an application that parses untrusted BSON...

CVE-2026-120954 Silent element-count truncation via 32-bit bit-length overflow in packed-bit vector views

A weakness in the BSON library's handling of a specialized binary vector data type allows an arithmetic wraparound when computing the number of elements described by an oversized attacker-supplied value. On builds where the platform word size is 32 bits, an application that parses untrusted BSON...

CVE-2026-121382 Netcore NBR100V2 auto_ac msg_aes_dec integer overflow

A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. Affected by this issue is the function msgaesdec of the file /usr/bin/autoac. This manipulation causes integer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized...

CVE-2026-121382 Netcore NBR100V2 auto_ac msg_aes_dec integer overflow

A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. Affected by this issue is the function msgaesdec of the file /usr/bin/autoac. This manipulation causes integer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized...

CVE-2026-46487 GeoNetwork: ACL bypass on Elasticsearch search when request body omits query field

GeoNetwork is a catalog application to manage spatially referenced resources. From 4.0.0-alpha.1 until 4.2.16 and 4.4.11, the Elasticsearch-backed search proxy can skip GeoNetwork's access-control filter injection when a client request has an omitted query field. The request is then forwarded to...

CVE-2026-46487 GeoNetwork: ACL bypass on Elasticsearch search when request body omits query field

GeoNetwork is a catalog application to manage spatially referenced resources. From 4.0.0-alpha.1 until 4.2.16 and 4.4.11, the Elasticsearch-backed search proxy can skip GeoNetwork's access-control filter injection when a client request has an omitted query field. The request is then forwarded to...

evine

Evine Interactive CLI Web Crawler. Evine is a simple, fast, and interactive web crawler and web scraper written in Golang. Evine is useful for a wide range of purposes such as metadata and data extraction, data mining, reconnaissance and testing. If you like the project, give it a star. It forces...

XXRF-Shots

What is SSRF vulnerability? Server Side Request Forgery SSRF is a type of vulnerability that enables attackers to send specially crafted requests through a vulnerable web application. With this technique, attackers can gain unauthorized access to internal resources behind a firewall, which would...

libc-database

Web interface libc-database now has a web service and frontend. Visit https://libc.rip/ to try it out! Read https://github.com/niklasb/libc-database/tree/master/searchengine if you are interested in the API. Building a libc offset database If you're getting errors, please check the "Requirements"...

CVE-2026-120955 MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS Metadata

The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user who can influence file download parameters can trigger this...

CVE-2026-120955 MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS Metadata

The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user who can influence file download parameters can trigger this...

CVE-2026-121652 Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering

Cross-site scripting XSS issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated users to inject arbitrary web script or HTML via the 1 title, 2 address, or 3 placename property in GeoJSON feature data rendered by popupRender, or the 4 geofenceId value rendered i...